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ABSTRACT 


This final report describes the activities of ARINC Research Corporation 
pursuant to the development of a flight safety measurement ami prediction capability 
for the U. S. Naval Safety Center. 


The methodology developed encompassed functional analysis of the F-4J air- 
craft. assessment of the importance of safety-sensitive functional paths, and the 
construction and exercising of a mathematical model to arrive at a numerical 
measurement of the safety criticalities of aircraft equipments. 


The results of this effort are presented in the text and appendices to this 
report. 


LC 
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FOREWORD 


In 1965, ARINC Research Corporation began to explore the desirability and 
practicability of an objective quantification of fight safety The investigation, which 
included a comprehensive review of current fight-safety activities, suggested the 
feasibility of developing a quantification tectnique. 


An Air Force-funded study by ARINC Research in 1967 demonstrated the 
feasibility of a predictive tectinique based on system reliability cheracteristics. A 
methodclogy was developed for providing flight-safety indicators sensitive to changes 
in equipment malfunction rates, ia their effects on the mission, and in unit or fleet 
operations. This methodology, in conjunction with accident data, permits timely 
predictions of accident potential, and can contribute to design evaluation and opera- 
tional planning by providing a degree of safety assessment previcusly unavailable. 
The Air Force continued funding of this effort to develop the mathematical models 
for the F-106 aircraft. 


In June 1968 the Naval Safety Center contracted with ARINC Research 
Corporation to extend this methodology to the F-4J aircraft. 


The first months of this effort were devoted to data surveys, collection of flight 
data, acquisition of aircraft documentation, and formulation of criteria for adapting 
the Air Force mathematical model to the Navy application. Resulis of this initial 
effort appear in the first interim report under this contract.* The report also 
describes the techniques to be applied in identifying functional relationships and 
assessing safety sensitivity. 


The second interim report,** describes the development of functional diagrams 
and safety sensitivity assessments for the F-4J aircraft. The functional diagrams 
and an example of safety sensitivity analyses are presented in the appendices. 


* Developmeut of Flight-Safety Prediction Methodol for U. S_ Naval Safety 
Center, Nov. 1968, Publication 753-01-1-938. 

** Development of Flight-Safety Prediction Methodology for US. Naval Safet 
Center, Apri! 1969, Publication 753-01-2-968. 
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1. TECHNICAL APPROACH 


1.1 GENERAL 


The purpose of this program was to extend the previously developed flight- 
safety measurement and prediction methodology to Naval aircraft and data systems 
The analysis is designed to evaluate malfunction data with respect to the safety 
implications that are uniquely associated with each phase of the mission profile. 
Through this effort the safety criticality of malfunction occurrences can be quantified, 
thereby allowing correction of flight safety problems on a safety-priority basis. 


At the outset of this study, ARINC Research conducted a functional critic. ity 
assessment of the F-4J aircraft. Criticality indices were developed which are 
sensitive to the flight phase in which the aircraft is operating, the degree of 
exposure to malfunctions in these phases, and the impact of this exposure on safety 


Identification of the safety criticality of malfunction occurrences. when fully 
developed and implemented, can be used in the prevention of accidents. This can be 
achieved through problem identification based on data from all Navy and Marine 
aircraft. 


The scope of this effort was limited to analysis of equipment functions and their 
relevance to flight safety. Flight safety problems such as pilot error, avoidance of 
air traffic, or enemy action can only be evaluated by this methodology to the extent 
that, should they cause loss of function (malfunction) of the aircraft equipment. the 
resulting degradation in safety can be assessed. 


1.4 CONCEPTS 


The mathematical model. and thus the safety methodology, is based on the 
premise that an aircraft is in a safe condition if it is operating within its prescribed 
performance limits. The model thus does not consider ejection capability, parachutes, 
life rafts, etc., which do not make an aircraft safer, per se, but provide for the 
survivability of the pilot when the aircraft is unsafe. 


The elimination of personal injury and property damage is the objective of all 
safety efforts. However quantification of these factors is not suitable for predictive 
purposes, being of value primarily as an after-the-fact performance indicator The 
safety quantification methodology developed by ARINC Research does not use dollar 
risk as the quantification parameter because the magnitude of this value is influenced 
by factors not inherent to the aircraft system, but usually to location and happenstance. 
Therefore, this technique assumes that dollar--damage is an "effect" of being unsafe 
The parameter of safety quantified by this approach is a measure of how often the 
aircraft will! be in u condition to cause damage (accident exposure). 
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The probability of an aircraft being in a condition to cause an accident can be 
expressed as the probability of an event multiplied by the conditional probability that 
the event will cause accident exposure. Stated in equation form, 


P|. =P x Pl 


a j 


where Py is the probability of an accident exposure due to event j; 


P, is the probability of occurrence of event j; and 
Pay is the probability of accident exposure given that event j has 
occurred (Sensitivity Factor). 


In terms of malfunction contributions to accident exposure, P; can be thought 
of as the probability of failure j, and Pg/j as the probability that the occurrence of 
failure j will result in accident exposure. The probability of accident exposure, Paj, is 
referred to as the Safety Criticality, and can serve as a parameter for ranking the 
safety significance of events. 


The Sensitivity Factor ( Pg/j) can be used to weight malfunction occurrence data 
to determine which malfunctions most degrade system safety. Sensitivity factors will 
often vary with mission phase, reflecting the change in malfunction importance with 
changes in the operating requirements associated with these phases. 


The predictive ability of the flight-safety quantification technique is based on 
the identification of event-occurrence trends that indicate probable changes in 
accident rate. 


1.3. APPLICATION 


Under the present effort a criticality assessment model for the F-4) aircraft 
was developed. The resulting criticality indices are responsive to the flight phase in 
which the aircraft is operating, the exposure to malfunction in these phases, and the 
impact on safety of this exposure. 


The identification of safety-problem criticality in operational aircraft provides 
the visibility necessary for arriving at decisions to mod or not-to-mod, optimizing 
of cost versus safety, and evaluation of the adequacy of corrective actions. 


When included in routine periodic malfunction data processing programs, 
criticality trends can be identified and corrective actions implemented, thereby pre- 
venting the occurrence of accidents due to the identified cause. 


This safety criticality assessment methodology could also be applied prior to 
an aircraft becoming operational. The assessment of safety sensitivity during the 
design phase of aircraft procurement can alert project management to potential 
trouble areas and functional weaknesses. 
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2. ANALYSIS 


In this section is discussed the development of 3 capability for assessing 
problem criticality with respect to flight safety The development comprises the 
six major tasks discussed in the following subsections 


2.1 DATA SOURCE SURVEY 


A survey of available Navy data was made to determine its adequacy and 
applicability relative to a flight safety model, and any modifications necessary to the 
Air Force model to accommodate Navy data. 


The Navai Safety Center's data bank was found to be adequately recording the 
malfunctions registered by the '"3-M"' data system, ano the capability already exists 
within the Center for computing mean time between failure 1 MTBF; from 3-M failure 
information coupled with flight times reported on pilot debriefing forms ivetiow 
sheets). As in the case of the Air Force math model idesigned for application to the 
AFM 66-1 data system), the "When Discovered” codes used in the 3-M svstem are 
inadequate for describing the length of time an aircraft is exposed to malfunctions--a 
basic input to the safety-prediction math model. 


An investigation was conducted to determine the impact on the predictive ability 
of the methodology if only total malfunctions versus total airframe hours were avail- 
able. Data collected from the Aerospace Defense Command during the earlier 
Air Force study were examined from this standpoint Rt was found that, due to a 
significant chang. in failure rate with flight time and mission phase, failure probabili- 
ties computed on the basis of a constant failure rate throughout the mission were 
unrealistic. It was therefore concluded that some form of data screening must be 
performed in order to provide accurate measurements of malfunction exposure. 


Due to the magnitude of the effort required to col:cct all flight-phase informa- 
tion from all navai aircraft, it wis deciged to initiate an experimental data-collection 
and analysis program that would provide the data necessary to determine actual mal- 
function exposure with respect to the total number of failures experienced. The 
Naval Safety Center arranged for this data collection effort to be conducted at the 
VF-121 Squadron, Miramar Naval Air Station. 


For this effort, ARINC Research compiled a manual for coding pilot-reported 
malfunction symptoms. The method of symptom coding is unique in its ability to 
allow machine processing of informal pilot "squawks."" This Navy manual was adapted 
from that used by the Air Force Aerospace Defense Commana in its Interceptor Sortie 
Evaluation Program, though extended to reflect the F4-B/J aircraft and naval mis- 
sion requirements. Additionally, AR™'NC Research developed an experimenta’ pilot 
debriefing questionnaire (Figure 1). These debriefings, held in the Maintenance 
Control Center following each sortie, provide first-hand (aircrew) information on anv 
malfunction of the aircraft, detailed mission profile information for each flight, and 
the flight-purpose code. 


This data-collection effort was begun in September 1968, and data were com- 
piled from 1000 sorties flown by .’F-121. Data received by ARINC Research from the 
squadron were reduced to computer-punchcard format for analysis of exposure indices. 


to 
' 
— 


753-01-3-982 


eeaeaene "” e 


9 
i Si NC SIS ay 
27 + oo 


wd ws Load . - an 


_ Cd 
Sa tap - - + 
- & 
~wo P94 4 
: —— PoReeerneees 
= + i’, . 
me 
oe eee ene ea ae ey ened 
ee 
‘eo a 
orm, a eta Arad 
4 
vom 
~ > 
— Ske Renee A 
Pe Bawa 
© ee + oo + 
aa GGG... 880 w 
>: Be 
U as @ 6 @ eo: ar>eseres 1 2 @ $$ @ * 6 H } fre 
Page Tee 0: Meee Ran m fe —————> 
_~— 1. CGE Oncervense/Rucasian, Preis 
=F. aun ————o 
- 2 oem Wm ww em - “ -» we ie o itd 
ee pepe ne oe <0 e+ 0 eH Gee - ese mene ee 
e ' 1 ' ! 
| ! eer Pe eng ecg gnig he: a > ’ 4 , 
ap ¢ eek ce fee tte 
a e+e ee eee & ero ree 
79ee is ices 
a eee oe 71+ - 
| 68aa paeaamas = 
i eee © + + © oH Pq 2 SS OP ED OSes GPa 
Par! 
| apav. a oe 2 ae a ar) re 
1 } 
| some “+++ Pee ree ear eee 
{ 
| | et ee a > oo 
} be _ 4 ese cee pyve  6¢ © 03 ry ese Cr 
' mre ot fete ———— 
r , ” s * 
Cad a Led ~ on rte Pea sm Comers 
” o- Jun eee Cot the Sat Cotet 
» o o ~ + + —+— —— 
' 
1) S eae ae oe ee 
. Paiute ' 
’ Pr er SS) oe rs a rh + 
BOBD oer ences crease. 6 Con 
nae 
oc ‘ eee oe ene He naam . _ —— --— Bcueeass 
ok YY Sarr are ara a . ie Jigs SS Se 
eae 
. - . > . eae - > ~ --— Oe 
Pn ae Se ae eee ae o o ~ ce 
ae 
. ee ee 
Pe: Re ee ee 
» a a a a a = pe ee 
fae rr rr fo _ 
neh 
+ ee ee eee a as > pe eee 
' 
' 
(oe ae Se 
Mate: Pee te 2 men 
. : . wa pres G © @remat Abort 
= C= a * hae at 
Comes 
wage Putrstang € ¢ merger 


BSeorecere 
iis 


a ee eles ea 


i2 min epent in start-up ‘tam 


| |o—_——-3 min for takeoff 


6 min for climb 


Cretee eut for approx 27 min at 
30, 000 f price te inflight refuetin, 
and 15 min cruise out at 30.100 
after inflight refucting 
12 min for iaflight refueling 
20 min for tactical and encape 


min for cruise return at 
25,000 ft 


9min for descem 


3mfin for landing 
18 min for tad shul-wwo 


Noeewheel steering problem which 
occurred during takeoff and landtr 
EGT too high - port engine, noted 
duriag climb, for approx % min 
Radar steering problem noted durir 
tactical & escape, approx 12 min 
Imercor between cockpits, inter- 
mittent, was noted during climb, 
duration was for remainder of Mig 


Oil pressure too high istb'd engine) 
was noted during return cruise, 
duration was for remainder of fli 


Port under item 17 indicates port 
engine problem 


Se a ee b= —__——"E" under Item 16, indicates pilot 
_,€ , Stee ' deciared sa emergency due to oil 


preseure problem  Stb'd under 
Item 17, tndfeates that problem 
was with sth'd engine 
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The information was then analyzed to determine the correlation between the number 
of failures reported and the actua! exposure to failure during flight. 


The Miramar data were first screened to eliminate C ARQUAL and FCLP 
missions, thereby representing oalv missions in which mission phases are sequential 
and nonrepetitive. Naval Safet, Center flight-time and 3M data for the Manual Flight 
Control System were compared \ ith the corresponding VF-121 data and found to agree 
closely in both average flight time (within two minutes) and failure rate. Because of 
this good correlation, the method of assessing failure probability by mission phase 
was established as 1) computing the “average mission" failure probabiiitv 


_ No. failures 
iP, =1-@ No. flights = 


and then 2) determining the ratio of aircraft in a failed condition to the total aircraft 
in eack ‘light phase. The ratio of the percent failed per phase to the mission failure 
probabi_it; was computed for each aircraft system for each mission phase. These 
values are listed in Table 1. In criticality computations utilizing 3M data, these 
values are used as weighting factors for mission-phase failure allocations. These 
allocations were used with the applicable safety sensitivity assessment to arrive at 
the mission phase criticality of malfunctions. 


2.2 AIRCRAFT DESIGN DOCUMENTATION 


The Naval Safety Center supplied ARINC Research with a complete set of 
Maintenance and Illustrated Parts Breakdown manuals for the F-4J aircraft. These 
documents served as the basis for functional analysis and the assessment of safety 
sensitivity. The adequacy of these documents is comparable to that of the equivalent 
documents on which the Air Force analysis was based. 


A review was made of the documentation available at ARINC Research on the 
F-4C aircraft, as compiled under the IROS program for the Air Force. Diagrams 
constructed during this program identify the functional relationships of equipments 
required for mission success. With respect to a safety sensitivity assessment. how- 
ever, the objective of the functional analysis must by definition be different; therefore 
this documentation was primar’ly of value in identifying Work Unit Codes for various 
aircraft equipments. 


Dve to the differences in the Navv/Air Force versions of the F-4, and the 
difference in the purpose of the two safety efforts, the functional analvsis under the 
Navy contract did not utilize the Air Force F-4C documents. They were used onl; 
as a reference in cases where questions arose as to how the aircraft operates. 


*This equ2tion reflects the application of the traditional reliability equation, R nee, 
; ; ee er Total Time 
modified to apply to only the average mission time ‘No. of Flights Flights” Because A is 
equal to the number of equipment {s.lures divided by the total flight time, the exponent 
becomes equal to the number of failures divided by the number of flights 
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2.3 MODEL DEVELOPMENT 


At the outset of this program. it was anticipated that the existing Air Force 
flight safety medel could be adapted in a limited-utility format for routinely processing 
Navy data to arrive at flight safety measurements. The initial idea was to use the 
total number of failures and the total flying hours to arrive at an average MTBF, and 
from this to compute the probability of faiture. The latter quantity, together with the 
sensitivity estimate, would then provide a meaningful malfunction exposure and/or 
a cident exposure index. Upon investigation, however, tne available information was 
found to be inadequate and inaccurate. Recognizing this factor, the Naval Satety 
Center agreed that, rather than have an early model with these properties, it would be 
far more desirable to embark upon an investigation to determine how oest to arrive at 
an accurate model. 


The first step in the subsequent activity was the initiation of a sample data 
collection program at Miramar. This effort resulted in obtaining actual equipment 
malfunction exposure measurements from which the basic factors affecting malfunction 
occurrence could be examined. 


The construction of a safety analysis, ‘criticality assessment model responsive to 
both the probability of failure and the signif:cance (sensitivity) of each occurrence and 
be exercisable with 3M data was successfully completed. In equation form, the 
criticality of each Work Unit Code (WUC) is assessed as follows: 


n=q / F 
a t 
c=), f1-€ )m, a8, 
n= 


where: C = total criticality of the Work Unit Code 


n = missicn phase number* 
m,= failure probability correction factor computed from the VF-121 
data (Table 1) 
q = provisory factor discussed in Section 2.5 
Ss ee missica phase sensitivity of the failure 
F = number of 3M reported failures 


f = number of flights over which the 3M data was collected. 


Thi, equation, then, represents the probability that a piece of equipment will cause 
accident exposure in an aircraft flying an average mission profile (i.e., a mission 
made up of the nine mission phases is considered t> be of about 100 minutes duration). 


*Mission Phases are numbered as follows: 


1 - Start and Taxi 4 - Cruise - Out 7 - Descent 
2 - Takeoff 5 - Bombing, Air-to-Air, etc. 8 - Land 
3 - Climb 6 - Cruise - Return 9 - Taxi-Shutdown 
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The criticality of each WUC is computed for each functional path that has a 
safety effect. The resulting quantity can then be applied to rank the WUC's in order 
of their safety criticality and therefore their current importance (on the basis uf 3M 
data) with respect to flight safety. 


2.4 FUNCTIONAL ANALYSIS 


The first step in generating eq uipment criticality indices for pinpointing 
aircraft safety problems was to identify the primary functions of the F-4J aircraft. 
The aircraft was first subdivided into nine primary and two support functions, the 
latter functions being "Utilities" and "Pilot.'' Designated as primary functions were 
those generally common to all aircraft and for which the necessity is readily apparent 
in each flight phase. These primary functions, which can be identified independently 
of the equipment necessary to perform them, represent the tasks that the equipments 
perform. The support functions are more equipment-oriented. For example, under 
the primary function "External Environmental Control" the aircraft was divided into 
three functional groups: "Anti-Ice,"' ' Lighting, ' and "Rain Clear."' These groups 
were then further subdivided and charted into functional diagrams depicting 1) the 
various events necessary to achieve them, and 2) the inputs from other functions. 

In general, these diagrams are ‘aid out showing, from left to right, the inputs, the 
function performed, the outputs, and the events achieved. 


The next step was to identify the items of equipment required to accomplish 
each subfunction or function. Equipment identification is normally made at the WUC 
level, thereby identifying how a WUC contributes to the accomplishment of a function, 


Each function of the aircraft carries an indentured "alpha" code indicating the 
primary safety sensitivity path, thus serving as an index for machine locating pur- 
poses. The diagram of Figure 2, for example. identifies the Aircraft Roll function 
as CC, which requires inputs from CCA-R and CCA-L, the right and left wing 
control surfaces, respectively. Because of the complexity of aircraft systems and 
the interdependency of one system on another, no consistent universal indenture 
system (from function to subfunction, etc.) is possible. One example of the problem, 
as can be seen in several of the diagrams in Appendix A, is the formation of func- 
tional loops. If all the diagrams applicable to an aircraft were combined, the total 
diagram would be so tangled with these loops that no meaningful analysis could be 
made. Accordingly, ARINC Research elected to follow the procedure of subdividing 
the aircraft into the nine primary and two support functions, identifying the input 
requirements for each and recording each functional relationship in a punchcard 
format. This procedure was followed down to the WUC level. A computer program 
was designed that could identify and document each functional path. 


Performing the path identification/documentation task by computer proved to 
be not only useful but necessary. As an example, for a single WUC in the flight 
control system, the computer identified and documented 182 functional paths in which 
this item affected the aircraft. The human analyst could never be expected to keep 
track of 182 functional paths or be expected to assign a numerical sensitivity to each. 
The machine processing allows the human analyst to consider only one ‘unctional link 
at atime. The ability to be able to follow all of the functional interrelationships 
within the aircraft is necessary for meaningful assessment of the safety. 
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Appendix A to this report contains the functional relationship diagrams 
applicable to the F-4J aircraft. Most of these diagrams have been revised since the 
publication of the second interim report (ARINC Research Publication 753-01-2-968) 
in April 1969. Revisions were necessary to reflect more clearly and accurately the 
interrelationships of the functions. 


Following each section of functional diagrams in the appendix is a listing of the 
functional and WUC relationship cards for that section. This listing identifies the equip- 
ment required to accompiish each subfunction, and the functions required to accomplish 
the next higher level function. The functional-link safety sensitivities are included 
in the individual cards and in the format of the printout. 


2.5 SENSITIVITY ASSESSMENT 


The process of assigning sensitivity values consists primarily of evaluating how 
much a particular function is needed for the next higher function. At the functional 
level immediately below a primary function, sensitivities are assigned for each 
mission phase. The assigned value is frum zero to one, representing an estimate of 
the percentage of the time that the loss of the function would result in an accident (a 
condition in which the aircraft cannot be operated within its prescribed performance 
parameters). By performing this proce. 3 at the functional level, the assignment of 
relative values across these major funct - - can be made uniformly, according to 
their relative importance. 


Each link was thus assessed until the major functions of the aircraft were 
reached. At this point the sensitivity of theee highest ievel functions were assessed 
independently for each of the significant mission phases for the aircraft. For 
instance, the landing lights have a safety significance of zero for all mission phases 
other than landing. Each sensitivity value was reviewed by a group of ARINC 
Research analysts at least three times to assure uniformity of criteria and standardi- 
zation of numerical assignments. These sensitivity values were included in each 
functional relationship card. 


Certain systems have a safety significance dependent on external influences, 
and for this situation Provisory Factors are identified. An example of this would be 
a windshield anti-ice system, which has a safety significance of close to one during 
landing under icing conditions but has a zero significance on a dry, warm day. In 
this example, the significance is identified as unity (worst case), and a Provisory 
Factor is assigned. By application of these factors (for instance, assigning a per- 
centage of the time that icing conditions are present), relative equipment sensitivites 
can be tailored to the conditions of a particular flight or geographic area. The pro- 
visory factors used in the sensitivity assessment of the F-4J are listed, together with 
their code identifiers, in Table 2. 


The sensitivity of each functional link, together with applicable Provisory 
Factors, are compiled in punchcard format, permitting sensitivity computations (the 
multiplying of all sensitivities from the equipment along each path up to the major 
function) to be performed by computer. This allows the sensitivity of WUC's to be 
assessed, regardless of the complexity associated with multiple and duplicate path 
relationships. 
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TABLE 2. PROVISORY FACTORS USED IN SAFETY SENSITIVITY 
ASSESSMENT OF F-4J AIRCRAFT 


Provisory or Conditional Factors 


Ice 
Night 
IFR 
Supersonic 
Rain 
Normal system failed 
Drag chute failed 
Cerrier takeoff 
Carrier landing 
Wheel brakes failed 
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The functional path identification/documentation program discussed in 
Section 2.4 multiplied the "link" sensitivities at each step in the path for each mission 
phase. A computer printout showing the path and sensitivity values for each WUC 
cannot be included in this report because of the bulk of such a printovt. However, 
Figure 3 is a reproducvion of a typical printout page. 


The path and the path sensiv‘vity information is stored on magnetic tape and is 
suitable for demand interrogation o. specific paths, functions, or WUC items. These 
data are used, in the criticality computations discussed in Secticn 2.6. A copy of 
this tape is being furnished to the Naval Safety Center. 


2.6 CRITICALITY MODEL EXERCISE 


Criticality assessment consists of 1) selection of the mission of interest--in 
this case, the average mission; 2) selection of the Provisory Factors for the 
applicable conditions; 3) inclusion of failure probability numbers; and 4) computation 
of the product of equipment failure probability and safety sensitivity (as modified by 
the Provisory Factor) for each phase of the mission. The criticality identified is then 
proportional to the accident exposure being created by each piece of equipment on the 
aircraft. 


A criticality computation pregram was developed which would accept 3M failure 
data (by WUC); compute the mission probability of failure, 
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apply the mission phase weighting factor; and multiply this value by the mission 
phase sensitivity. 
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The mission phase criticalities are then summed over the mission to obtain the 
total mission criticality. Criticalities were computed for e:ch WUC alpha designator 
(i.e., each individual component) by dividing the total number of failures by the 
number of alpha designators, thereby treating each as a separate item. The WUC 
criticality for those items. where more than one item of that WUC is installed, is 


then the summation of the criticalities for each alpha designator applicable to that 
WUC. 


The Naval Safety Center supplied the failure and flight data for the 12 months 
of May 1968 through April 1969, and a criticality model exercise waa completed. 
Appendix B contains the results of this model exercise. The flow chart and program 
listing are contained in Appendix C. For purposes of this model exercise, all pro- 
visory factors were set to zero. Therefore the criticalities in Appendix B are 
representative of a "perfect" mission environment with field takeoff and landing and 
the presumption that emergency backup systems are available but not needed. 


2-11 


753-01-3-982 


3. CONCLUSIONS 


The use of the criticality computation model with the monthly 3M data 
processing will permit not only identification of the current month's critical problems, 
but also allow for the examination of undesirable saiaty trends. 


Thus a capability has been developed for providing flight-safety indicators 
sensit:ve to changes, in equipment malfunction rates, in their effects on the mission, 
and in unit or fleet operatioas. This methodology, in conjunction with accident data, 
permits timely predictions of accident potential; and can contribute to design 


evaluation and operational planning by providing a degree of safety assessment 
previously unavailable. 
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APPENDIX A 


FUNCTIONAL ANALYSIS OF F-4J AIRCRAFT 
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A.1 GENERAL 


This appendix contains the results of the functional analysis performed by 
ARINC Research for the F-4J aircraft. The tab locators identify nine primary and 
one secondary functional aircraft system (no diagram is included for the " Pilot"). 
The functional sections are lettered and the pages numbered according to function 
level, The title block on each functional diagram identifies the NAVAIR documents 
(including dates) used in construction of the functional diagram. In cases where the 
NAVAIR document described several configurations for aircraft block groups, the 
latest configuration was used for the diagram. 


Wherever possible, diagrams are laid out with the inputs on the left side of 
the page and continuing through the sequence of events to the final function on the 
right side of the page. Unlike a reliability block diagram, in which blocks in series 
indicate a tying together physically of equipments, the series of blocks in these dia- 
grams will iadicate that if all of the input events to the left of a block occur, and the 
equipment unique to the functional block is operating, then that function will have 
been performed. 


A form of shorthand logic symbology was used to depict the functional relation- 
ships, in which each input to a functional block which enters with a unique arrowhead 
can be considered AND functions, and inputs whose function lines are joined prior to 
the arrow entering the next functional block can be considered OR functions. Fig- 
ure A-1 represents this relationship. 


A A 
C 
B 
A and B are needed for C. A or B is needed for C. 
Figure A-1 


.A-2 
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A.2 ORGANIZATION 


The functional description portion of this appendix is divided into ten sections. 
The first section describes the aircraft, in general. This diagram depicts the pri- 
mary aircraft functions, together with the alpha designator assigned to each. For 
instance, the alpha designator "A" will prefix all functions and equipments associated 
with gruund control of the aircraft, all of which will be found behind Tab A, Ground 
Control. On the tab sheet will be the functional breakdown of the primary function, 
together with a listing of the order in which the diagrams will appear. Following the 
diagrams in each section will be a computer listing of the function cards, showing inputs 
required and dependent functions; and of work unit codes, together with the function 
and in the functional chain to which the WUC operation contributes. The WUC's used 
to identify equipment types are as documented in NAVAIR 01-245FD-8, revised 
1 June 1968, 


If more than one piece of equipment with the same WUC is installed in the air- 
craft, each will be identified with a different alpha designator. If the same piece of 
equipment performs more than one function or operates in more than one functional 
branch, it would maintain only one alpha designator for all of the applications. This, 
therefore, provides a method for determining whether one piecr of equipment has many 
effects, or whether many pieces of the same equipment are used in the aircraft, each 
providing one or many different effects. 


The foilowing page provides a guide for reading the printouts in this appendix. 
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Function or Equipment Name 
Work Unit Code Number 


"Alpha" Designator for WUC or Function (may be 
preceded by an R or L indicating right and left) 


Functional "Inputs" Required 


Dependent Functions of Function listed under 
" Alpha"' 


Conditional or Provisory Factor and Alpha Desig- 
nator for alternate function if applicable 
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Sensitivity value for WUC with respect to function 
listed above it. (Values are A=1.0, 9 =0.90, 
8 = 0.80, etc.) 
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Functional Sensitivity with respect to the listed 
dependent function by Mission Phase 
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This appendix contains the flight-safety criticality assessment for the F-4J 
aircraft. 


These criticalities are based on the combined failure data for May 1968 through 
April 1969, the flight history for the same period, the sensitivity values for each 
Work Unit Code's functional path, and the weighting factors applicable to the distribu- 
tion of system failure probability derived from the VF-121 data collection effort. 


All conditional or provisory factors were set to zero for this model exercise. 
The criticalities therefore are based on VFR daylight mission with field takeoff and 
landing in which backup (emerge!.")) systems are available but not needed. This 
appendix is divided into two sections, the first ranking WUC's by their criticality, 
and the second listing the same information but sorted according to WUC. 


The format used in the printout shows the WUC on the left followed by the 
name, the criticality in each mission phase, and finally the total criticality. 


In cases where there are more than one alpha designator (more than one part 
having the same WUC), the name is listed with the applicable alpha designator; its 
criticalities are shown for each mission phase; and the combined criticalities for 
all alphas having that WUC are shown on the line in which the WUC is listed. 


Mission phases are numbered in accordance with the footnote on page 2-5 of 
the report. 
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APPENDIX C 
COMPUTER PROGRAMS AND LISTINGS 
C-1 
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This appendix presents the computer program listings for the six programs 
required for construction and exercise of the F-4J flight safety model. 


The first program, "Navy Top-Down Path Generator" illustrates the path- 
identification and safety-sensitivity computation. Under each diagram is indicated 
the corresponding steps in the program listing. 


The second program, "Criticality-Calculations", computes the path criticalities, 
then combines them for each Work Unit Code and mission phase. inputs to this 
program are the path sensitivities from the first program, and Navy 3M data. 


The other four programs are presented as lists because of their simplicity. 
These programs are: 


a. "Top-Down Printout Routine" which prints out the results of the first 
program. 


b. "Top-Down Tape Gen'"' which accepts the functional cards and produces a 
Dictonary Tape showing WUC, alpha's, and name; and a Dependent 
Function Array Tape containing sensitivity values for each functional link. 


c. "Top-Down Tape Sort'' which sorts the Dependent Function Array Tape 
by dependent function for use in the Top-Down Path Generator Program. 


d. "Sort + Merge Path and Failure Data'' which merges the path sensitivity 
information with the failure data applicable to each WUC for use in the 
Criticality Calculations Program. 
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«, 


vee 


NAVY TOP-DOWN PALH GENERATOR 


pe 


(Listing Items 136-161) (Listing Items 168-180) 


OUTPUT-SEC SECTION 
OPEN FILES, 


os! 


SET 
COUNTERS 


°F RFORM 
OS2 “LALLY 
DA-IND, 1000 


READ-DATA- 


CARDS SECTION (DA-IND), 


RDCt 
PERFORM SHIFT-ALPHA. 
MOVE WF11) TO FAL. 


MOVE WFLR(1) TO FALR. 
MOVE 0 TO ANF. 


# DDEP-FUNC2 
(DA-IND). 


PERFORM 
FIND-ALPHA 


PERFORM 
PICK-I P- 
INPUTS 


PERFORM 
UTPUT-SEC 


READ- 
CONTROL, 


FILE 2 


PIRIORM 
PICh-U P- 
wees 


END-OF -CARDS 


MONITOR PUNCH- 
CNT (LOSE 
PUNCH CARDS, 

PRINT. STOP RUN 


moe 
Done aes oe 
peas 


A 


pasty 


a 
of 
o> 


oo 


tt wt beeen 


‘ae ve 
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NAVY TOP-DOWN PATH GENERATOR 


(Listing Items 236-282) 


PICK-UP-INPUTS SFCTION 


4 


PERFORM 
PL2. 


MOVE 
DPHSFNS 


(TALLY) TO 
WSFNS2. 


g S 


Ye PERFORM 
SET-CON-FAC 


MOVE DALPHA(TALLY) TO 
WFUNC2(1), 

PERFORM PU-CALC TLLY2 «= 1-9. 
MOVE WFUNC2(1) TO IDENTIFIER-1. 
IMOVE WFUNC2(2) TO IDENTIFIER-2. 

MOVE 1 TO CARD-NO1. 
MOVE 2 TO CARD-NO2, 
PERFORM CHECK-FOR- LOOP. 


PERFORM 
OUTPUT- 
FILE2 


PFRFORM 
OUTPUT- 
FILEL 


PERFORM 
OUTPUT- 
FILFt 


ADD 1 
TO 222 


PUNCH-CNT 


(Listing Items 289-316) 


PICK-UP-WUCS SFCTION 


MOVE WORK-CARD2 TO 
WORK-CARD 5, 
MOVE NO-2-WORK-CARDZ TO 

WORK-CARIN®, 
MOVE DWUC-SENS(TALLY) TO CONN1. 
PERFORM CONVERSION1. 


P} RFORM 
+t T-CON-FA 


MOVE DALT-FUNC(TALLY) TO CALT-FUNC 2 
PERFORM SHIFT-AIL.PIIAI. 
MOVE DWUCITALLY) TO WEUNC211). 
MOVE DALPHA(TALLY) TO WFUNC2(2). 
MOVE TO PATH-COMP2. 


PERFORM DW-CALC TLLi2 1,4, 


MOVE WFUNC2(1) TO 
IDENTIFIER-1. 
MOVE WFUNC2(2) TO 
IDENTIFIER-2. 
MOVE 1 TO CARD-NO1. 
MOVE 2 TO CARD-NO2. 


PFRFORM 
OUTPLT- 
FILE2. 


CFILE RE AD- 


CONTRO 


PERFORM 
OUTPUT- 
FILE. 


PERFORM 
OUTPUT- 
FILE1. 


MOVE WORK-CARD3 TO WORK-CARD2. 
OVE WORK-CARD99 TO NO- 2-WORK-CARD2 
ADD 1 TO PUNCH-CNT. 
MOVF SPACE TO PATH-COMP 


A 


2 
’ 


Fe age ep OE er EE Ae ee et 
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NAVY TOP-DOWN PATH GENERATOR 


(Listing Items 343-361) 


CARD-INPUT SECTION 


IONITOR READ-CONTROL.. 
MOVE 999 TO D2-CNT. 
ADD 1 to RUN-CNT. 


MOVE SPACE TO WORK- 
CARD2, NO-2-WORK- 
CARD2. MOVE CARD1 TO 
WORK-CARD1. MOVE 
CSENS TO SEL81. 


MOVE CARD1 TO 
NO-2 -WORK- 
CARD2. ADD 1 
TO C1-CNT. 


MONITOR 
WFUNC1(1) 
GO TO ROC1, 


(Listing Items 362-386) 


INPUT-FILE} St CTION 


MOVE FILE! TO READ- 
CONTROL. CLOSE DRUM- 
FILE1, DRUM-FILE?. OPEN 
INPUT DRUM-FILE1. OPEN 
OUTPUT DRUM-FILE2. 


MONITOR D2-CNT. 
MOVE 0 TO D1-CNT. 
D2-CNT. ADD 1 
TO RUN-CNT. 


MOVE SPACE TO WORK-CAR2, 
NO-2-WORK-CARD2. MOVE 
DF1 TO WORK-CARD1. MOVE 
CSENS TO WSFNS1, 


MOVE DF1 
TO NO-2- 
IWORK-CARD2 


ABORT) 


ADD 1 TO 
DI-CNT. 


(Listing Items 386-397) 


INPCT-FILE.2 SECTION 


MOVE FILE2 TO READ 
CONTROL. CLOSE DRUM- 
FILE!, DRUM-FILE2, OPEN 
INPUT DRUM-FILE2. OPIN 
OUTPUT DRUM-FILE1. 


ENDEKUN 


MONITOR D1-CNT, 
MOVE. 0 TO D1-CNT, 
D2-CNT. ADD?! 
TO RUN-CNT. 


MOVE SPACE TO WORK-CARD. 
NO-2-WORK*CARD 2. MOVE 
DF2 TO WORK-CARDI, MOVE 
CSENS TO WSE Not 
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753-01-3-982 


CRITICALITY-CALCULATIONS 


(Listing Items 162-179) 


PO 


OPEN 
HES 


PERFORM 
CLEAK- 
ARRAY 

TALLY=2, 5100 


PERFORM 
CLE AR- 
TOTAIS 

PALLY te" 


OPEN INPUL 
DICT-FAPE. 
PEREOKM 
TAP) -INPUL 
ClAsi 
DICT-LAPL, 


MOV 0 LO CREDeRANK. 

MOVE 9d LO LIND -ONG 
MOV) SPACL LO 

PRINT - LIN 


SORT ESORL ON 
DISCENDINGREY. TRIS 
INPUT PRO, TR INSEC, 

OUTPLL PRO, IS 
OLLASLC 


(Listing Items 184-208) 


IN-SFC SECTION 


MOVE WC1 TO 
Ch-WUC1, 


MOVE 1TO 
NO-WUCS 


MOVE NO-WU*S TO KNW. 
MOVE rT1 TO NFAILED. 
DIVIDE KNW INTO NFAILED 
GIVING NFAILED 


COMPUTE 

PFAIL © |-F°* 

(-NFAILED ‘ 
) 


MOVE WUC 
TO CK-WUC. 


MOVE WUC-ALPHA TO 
CK-ALPHA 
MOVE WUC-ADLR TO 

CK-ADLR. 
PFRFORM CONVERSION} 
TALLY = 1,9, 


PLRFORM 
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CRITICALITY-CALCULATIONS 


(Listing Items 184-208) (Listing Items 209-219) 


CHIPS ALILY-C AIL 


COMPETE PCLICPALLYD 
PEAIL* PFRCENT(K, TALITY) 
* TPC MITALIY). 


PERFORM 
Yer Jen PIMINARY 
ai OUrPUL 


PERFORM 
TOTAIL- 
OUTPUT 


ADD PCPMTALLY) TO GRAND- 
TOTAL-CHIT(TALLY), PR} LIM- 
TOTAL-CRITITALLY) 


Iset AW 


PEREORM 
PRE LIMINAIY 
OUTPUT 


ALPHA OR WUC 
ADLIC/ CK 
ADER 


PERFORM 
SONVERBIONL 
TALLY « 
1-0 


DREAD Fat TE RS ere OO DT. 


PFRIORM 
RITICALITY- 
CALC TALLY 


(Listing Items 225-234) 


PERLORM 
PRELIMINARY 
OULPUT 


ec hi aA ala ici ice a Ria ar ea tee Rl Lg a el 


PERFORM 
TOTAL- 
OUTPUT 


(Listing Items 240-264) 


Q ST-SEC SECTION 


MOVE WUCS TO 
DWUC, PWUC. 
MOVE NLALPHA 
TO DALPHA. 


MOVE NLADLK TO 
DALR. 
MOVE TITLE1 TO 
DTITLE. 


PERFORM PHASE-MOVE 
TALLY 1-9. 
ADD 1 TO CRIT-RANK. 
MOVE CRIT-RANK TO 
D-RANK, P-RANK, F-RANK 


MOVE TC) 
TOTAL-CRIT 


PERFORM 
HEAD- LINFS 


RITE PLNC 
TINE FLOM, 
WORK- 
HITE. 
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CRITICALITY-CALCULATIONS 


(Listing Items 313-336) 


PRE LIMINARY-OUTPUT SECTION 


PREL 


PERFORM 
PR? 
TALLY - 1.9.) 


MOVE CK-AI PHA TO FAL, 
WLALPHA. 
MOVE CK-ALPHA TO 
DALPHA. 
MOVE CK-AOLR TO FALR, 
WLADLR, DAIR. 


MOVE 0 TO 
ANF, 
PERFORM 
FIND-ALPHA 


MOVE DA- 
TITIt 
ADA-IND) 
10 TITLED, 


MOVF 0 TO 
Cl, PER- 
FORM COM> 
RINE -C RIT 


MOVE WUC-AT PHA 
TO CR-ATPHA 
MOVE WEC-ADLR 
TO CRK-ADLR 


(Listing Items 340-360) 
to PAl-Cl FPUT SRC DION 


“TTS 
TORT LALLY 
ley, PERS 

FORM COM. 
HIN -C RIT. 


MOVE CK-AEIIA If 
WIALPHA, PAT 
MOVE CReADEM 1 
WLADI A FATE 
PEIP ORM TNDe NS PU 


MOVE SPACE 
CO WLAL PIA 
MOVE SPACI 
TO WLADIA, 


MOV DAS 
Chote 
DA-INGD 
on 


Movt SPACH 
fo cin, 
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